Google SAM and Stanford DeLM: Kill Switches and Security Threats in Agent P2P Networks

In multi-agent environments spanning cloud and on-premises infrastructure, P2P architectures where agents communicate directly without a central orchestrator are emerging as a new alternative. The Sovereign Agent Mesh (SAM) project recently released by Google engineers and Stanford University's Decentralized Language Model (DeLM) research are leading open-source architectures driving this trend. However, instead of simply solving infrastructure bottlenecks, these new distributed structures demand serious architectural trade-offs between remote kill switch concerns in central control networks, data corruption risks, and zero-trust verification.

Google SAM: A Sovereign Mesh Without 'Sovereignty' and the Remote Kill Switch Controversy

Although SAM, recently released by Google engineers, drew attention for providing secure agent-to-agent tunnels via P2P, internal source code analysis revealed the existence of a centralized control mechanism and a remote kill switch, sparking intense governance debates. Despite presenting an innovative overlay mechanism that combines libp2p and Biscuit tokens to establish zero-config encrypted tunnels and share MCP tools flexibly, the central control logic designed beneath it undermines the very concept of a distributed network.

According to architectural analysis by theCUBE Research, a mechanism for forcing node shutdown is present at the source code level via the control plane's administrator API path: POST /admin/revoke If a local node is included on a blocklist while requesting a periodic handshake, the control plane returns a 403 error, and the receiving local daemon process is configured to terminate immediately.

Furthermore, the strict 24-hour expiration limit on Biscuit tokens, which serve as cryptographic credentials, poses a critical governance threat. If communication with the central control plane is lost for even one day, local nodes execute a self-destruct logic that stops the process while logging a renewal failure. Coupled with constraints that cause nodes to halt if connection to the router is lost for just 3 minutes, it is difficult to rely on the resilience of an autonomous P2P network during periods of instability or network isolation.

Ultimately, backend and infrastructure engineers who rely on the public testnet mesh suggested by the basic quickstart guide face infrastructure risks stemming from total dependence on single-point control. As this directly contradicts the absolute sovereignty agents in a P2P mesh should possess, it proves that for enterprise environments where security boundaries and autonomy are critical, a DIY self-hosted design that completely blocks public networks and establishes a private control plane is essential.

Stanford DeLM: Collaboration Without an Orchestrator and the Security Boundaries of 'Shared Memory'

DeLM, released by Stanford University researchers, is a decentralized architecture where agents collaborate asynchronously through shared context and task queues without a central orchestrator. Individual agents independently receive and process tasks, then record only compressed 'Gists' of core content into the shared context instead of original execution logs. By eliminating unnecessary communication bottlenecks and redundant inference, it has demonstrated a reduction in latency and inference costs of up to 50% compared to existing multi-agent systems.

However, this efficient 'shared memory' model operates on the assumption that all participating nodes belong to a single trust domain. Since every agent reads and writes directly to the shared context, the compromise or hijacking of even a single agent can spread threats throughout the entire network. If an attacker injects abnormal tasks into the shared task queue or inputs distorted Gists, other agents—trusting these as normal progress—become defenseless against task injection attacks that cause a cascade of erroneous operations.

To prevent this, DeLM is designed to pass through an Admission-Time Verification step to check reliability before writing data to the shared context. However, the current verification model only reviews the consistency of the agent's judgment, not the cryptographic validity of the node's signature or authorization to write. Therefore, to build safe security boundaries in an environment without an orchestrator, the introduction of a decentralized token system that verifies the provenance of information and granularly controls individual node permissions is required.

Real-World Infrastructure Application: DIY Self-Hosting and Biscuit Verification

When developers introduce P2P agent networks into production, avoiding remote control or forced termination risks requires choosing 'DIY mode' over SAM's default public mesh service, and hosting the control plane directly within corporate infrastructure. Building custom relay nodes within an internal enterprise network or an isolated private cloud—bypassing central servers—effectively eliminates control risks posed by external vendors. This is a practical solution to resolve the governance dependency issues that arise when relying on standard public cloud control planes.

In distributed collaborative structures like DeLM that lack a central orchestrator, granular security control at the individual agent node level is even more critical. For this, it is necessary to connect encrypted tunnels via libp2p while simultaneously incorporating an asymmetric key-based Biscuit token verification system at each node. Biscuit tokens support cryptographic attenuation, allowing flexible addition of permission constraints and issuance of sub-tokens without reliance on a central server.

By utilizing this, when an agent calls another node, the scope of allowed tools and data access can be restricted to the minimum required at runtime. Since receiving nodes independently verify the token's signature and constraints using their own asymmetric keys even while offline, stateless zero-trust security can be immediately implemented across the entire distributed network.

Conclusion: How to Take Charge of the Control Plane

AI agent networks are moving away from traditional centralized API gateways toward local-first P2P mesh structures. While distributed structures solve infrastructure bottlenecks, they also pose new architectural challenges regarding the loss of control. Developers must find a clear balance between the risks of information contamination inherent in distributed structures and the remote control risks hidden behind their convenience.

As seen with the limitations of SAM and DeLM, merely adopting distributed protocols cannot guarantee absolute sovereignty and security. To secure true autonomy, developers must self-host control planes within their own infrastructure and implement precise access control based on tokens like Biscuit. Only by reducing the 'black box' areas of infrastructure and personally controlling the authority of the control plane can a secure agent network be achieved.